Minimize vulnerabilities by offering service which offers simple notifications when new SDK/Runtimes are released
- Dominant language
- PowerShell
- Stars
- 22k
- Forks
- 4.9k
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 29
Description
Currently, whenever a vulnerability is discovered in dotnet SDK/Runtime somewhere and a subsequent update is made and released, developers in the community are either
-Not notified immediately
-Notified by email (by subscribing/watching the announcements)
Its great that engineers can subscribe/watch the announcements to get this information, but in my opinion there is major room for improvements in order to _minimize vulnerabilities globally_.
For example: Imagine Microsoft dotnet core team offered a simple website which had a simple form: Two input parameters
"Hey developers. Want to be notified immediately when new dotnet SDK/Runtimes are released? Tired of discovering vulnerabilities in SDK's days/weeks/months after they are found? Enter your email and phone number below to get immediate notifications when we make updates."
Input: Email
Input: Phone Number (SMS enabled)
SMS has open rates that are around 90%, and makes SMS a far superior communication channel than email. However, getting notifications on both is optimal since it decreases the average time it takes the average developer to discover these updates.
For example: Lets imagine that today, the average amount of time it takes any given developer to realize a new dotnet core SDK/Runtime was released is 15 days.
AVGTimeToDiscovery = 15d
Now, if we were to implement an SMS notification to those interested in getting these updates real-time instead, its highly likely (and perhaps agreeable to many) that the AVGTimeToDiscovery for those that do subscribe to be less than 15d
AVGTimeToDiscovery (considering engineer subscribes to SMS) < 15d
Would anyone dispute that having an SMS notification would have little to no impact?
To be completely honest, this is a service that I myself could build/engineer. However, its really worth offering and socializing this type of website/service in the instance Microsoft feels its worthwhile to offer/engineer.
Please let me know how I can minimize the amount of time it takes to get notifications. 1 issue I have with subscribing/watching announcements is that if we get emails with announcements for changes other than new SDK/Releases, those emails get noisy. Here, I am assuming that my goal is the same goal as many others:
Minimize amount of time vulnerabilities exist on local development machines + app servers.
1 solution ( not the only certainly) is to allow engineers to get SMS updates only when new SDK/Runtimes are released. What is the thought on this?
Thank you in advance for reading this concept. Ultimately, I hope to improve the speed for everyone, not just myself. I dont feel that I am alone in this goal.
Contributor guide
Assessment
This issue has not been assessed yet.